Symantec Security 5600 Series, Security 5400 Series,Clientless VPN 4400 Series, Administration Manual

Page: 291 / 861

290 Controlling traffic at the security gateway
Using packet filters to allow or deny traffic
Creating a packet filter
The packet filters and packet filter groups you create specify an allow or a deny action and an ordered
set of match criteria. The order of packet filter elements is important since the first match to any
packet passing through the security gateway or the tunnel is the only one that applies.
A packet filter consists of at least one instance of a protocol and a direction matched to a specific pair
of network entities. All packet filters are characterized as A -> B and B ->A, where A and B each
represents a network entity. The direction of the arrow specifies which entity can initiate the
connection. The order in which the packet filters are applied is crucial since the first match to any
packet passing through the security gateway is the only one applied. Each packet filter has two
network entities: Entity A and Entity B.
You cannot use domain name entities or entity groups with domains in them. Packet filter endpoints
must have valid IP addresses. To create a packet filter for Client VPN users with a dynamic address,
select Universe for the endpoint.
Note: If you are remotely managing your security gateway, ensure that you do not create a packet filter
that eliminates remote SGMI access.
By placing several hosts in an entity group, that you can configure a single packet filter associated with
the group to cover many possible permutations between several hosts at once.
For example, a packet filter template called securemail encompasses the following:
A -> B smtp, B -> A smtp
The packet filter template securefiles encompasses the following:
A -> B ftp, B -> A ftp
Applying the packet filter group secureservers , comprised of securemail and securefiles, to a tunnel’s
VPN policy is equivalent to applying all these packet filter elements as follows:
A -> B smtp
B -> A smtp
A -> B ftp
B -> A ftp
Note: Although not required, you should stop and restart the security gateway when introducing
packet filters into your configuration to avoid unexpected or undesired behavior.
Prerequisites
None.
To create a packet filter
1
In the SGMI, in the left pane, under Policy, click Firewall .
2 In the right pane, on the Packet Filters tab, click New > Packet Filter .
3
In the Packet Filter Properties dialog box, on the General tab, do the following:
Filter Name Type a name for the filter.
Action Click Allow or Deny.
Entity A Select a network entity to serve as entity A for this filter.
Entity B Select a network entity to serve as entity B for this filter.